Prior attempts at systems and methods for system security can include an operator analyzing a large amount of security related data, such as events logged by one or more subsystems (e.g., access control system, intrusion detection system, perimeter protection system, Closed-Circuit Television (CCTV), etc.). Such systems can have an operator make a number of decisions in a short amount of time.